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(54) Extra-safe remote control 

(57) A remote contrc)! uses a recognition code which consists of a fixed portion and a portion varying with time. The time 
code is generated simultaneously by a counter (7) in the transmrtter (2) and a counter (30) in the receiver (3). both counters 
being synchronized with each other at the customization stage and subsequent to each operation of the remote control. The 
recognition code transmitted is thus correlated at all times with the instant in which the code is transmitted, and so varies 
with time for safeguarding against unlawful entry by copying the recognition code. 
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EXTRA-SAFE REMOTE CONTROL 

The present invention relates to an extra-safe 
remote control. 

Known remote controls comprise a transmitting 
element for supplying a recognition code to a receiver 
connected to an actuating element fitted/ for example, 
to a vehicle for enabling centralized control of the 
vehicle doors. 

The remote controls dealt with in the following 
description are those enabling modification of the 
memorized code, using an electrically erasable 
programmable read only memory (EEPROM), and whereby the 
code is transmitted to the receiver via infrared pulses. 

A major drawback of Icnown remote controls of the 
aforementioned type is the possibility of unauthorized 
copies being made of the recognition code using 
automatic code copiers originally designed for other 
uses (specifically for combining in one control all the 
codes governing various home appliances, such as 
televisions, video recorders, compact disk readers, 
etc.) and which provide for memorizing the code as it is 
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transmitted/ and for subsequently producing and 
retransmitting a copy. Consequently, when applied to * 
recognition codes governing the actuator of a vehicle 
door release mechanism, such copiers enable the vehicle 
doors to be opened at any time, even without the 
original remote control. 

Nor can such a system be combatted by simply 
modifying the code, using encryption systems or by 
varying the electric characteristics of the code pulses, 
as these too would simply be reproduced by the copier. 

It is an object of the present invention to 
provide a remote control designed to overcome the 
aforementioned drawback, i.e. which provides for 
improved protection against forcible entry by copying 
the recognition code. 

According to the present invention, there is 
provided an extra-safe remote control, particularly for 
controlling a vehicle-mounted actuating element, said 
control comprising a transmitter having transmission 
transducer means for transmitting a recognition code; 
and a receiver having receiving transducer means for 
receiving said recognition code, and means for 
generating an enabling output signal in the event of the 
incoming recognition code substantially matching a 
reference code; characterized by the fact that said 
transmitter and said receiver comprise respective means 
for generating a time code varying with time. 
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According to the present invention, there is also 
provided a method for remote control of an actuating 
element, said method comprising stages consisting in: 
transmitting a recognition code, receiving said 
recognition code, comparing the Incoming recognition 
code with a reference code, and generating an enabling 
signal in the event of said incoming recognition code 
substantially matching said reference code; 
characterized by the fact that said recognition code 
transmitting stage comprises stages consisting in: 
generating a time code varying with time, and 
transmitting said time code; and said stage wherein said 
incoming recognition code is compared with said 
reference code comprises stages consisting in: 
generating a reference time code varying with time, and 
comparing said incoming time code with said reference 
time code. 

In other words, according to the present 
invention, any copies made of the recognition code using 
currently en5>loyed copiers are rendered ineffective, by 
virtue of the memorized copy relating to the first 
transmission of the code, when the copy is made, and 
falling to evolve dynamically with the time code 
generated in the receiver. Consequently, the memorized 
copy of the code is not recognized by the receiver, 
which thus fails to emit the enabling output signal. 
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A preferred^ non-limiting embodiment of the 
present invention will be described by way of example 
with reference to the accompanying drawings, in which: 

Fig.l shows a simplified block diagram of the 
remote control according to the present invention; 

Fig. 2 shows a schematic diagram of the recognition 
code according to the present invention; 

Fig. 3 shows a variation of the Fig .2 recognition 

code; 

Fig.s 4 and 5 show two simplified flow charts of 
the enabling method according to the present invention. 

Number 1 in Fig.l indicates a remote control 
consisting, in known manner, of a transmitter 2 and a 
receiver 3. More specifically, transmitter 2 comprises a 
control unit 4, a power supply unit 5, a non-volatile 
memory 6, a counter 7, a clock 8, an amplifier 9, and a 
transmission transducer 10. 

Power unit 5, which includes a replaceable battery 
(not shown), provides for generating at output 11 the 
supply voltage for operating the various components of 
transmitter 2, output 11 being connected to a capacitor 
12 for maintaining supply to transmitter 2 over a brief 
period and so enabling replacement of the battery with 
no loss of data. Memory 6, e.g. an EEPROM, is connected 
to control unit 4 over a two-way line 13, and provides 
for memorizing the recognition code of remote control 1, 
which may be modified as described in Italian Patents 
1.183.797 and 1.196.831 filed respectively on 4.4.85 and 
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10.12.86 by Turatti Mario. Counter 7/ which is connected 
to control unit 4 over one-way outgoing and incoming 
lines 14 and 15, provides for generating a time code 
(supplied over line 14) evolving with time according to 
a predetermined law, on the basis of increment pulses 
supplied by control unit 4 over line 15 and in turn 
generated by control unit 4 at predetermined intervals 
on the basis of sync pulses supplied to control unit 4 
by clock 8 over line 16. 

Control unit 4 is also connected to a hand switch 
18 for operating transmitter 2 and emitting the 
recognition code, and to a LED 19 for indicating the 
operating mode of transmitter 2. The code supply output 
of control unit 4 is connected over line 20 to the input 
of amplifier 9, which drives transducer 10 for emitting 
the pulses, e.g. infrared pulses, relative to the single 
binary digits of the code. 

Receiver 3 comprises a receiving transducer 26 
output-connected to the input of an amplifier 27 in turn 
output-connected to a receiving control unit 28 also 
connected to a memory 29, a counter 30, a clock 31, a 
power supply unit 32, a hand switch 33, and a LED 34. 
Control unit 28 also presents an output 35 connected to 
the actuating device being controlled (not shown) • 

More specifically, memory 29, connected to control 
unit 28 over a two-way line 37, provides for memorizing 
the fixed though user-variable portion (identification 
code) of the recognition code, and preferably consists 
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of an EEPROM. Counter 30, connected to control unit 28 
over a two-way line 38, provides for generating the 
variable time code, corresponding to the time code 
generated by counter 7 of transmitter 2, on the basis of 
pulses generated by clock 31 and supplied to control 
unit 28 over a one-way outgoing line 39. In this case 
also, counter 30 is incremented by control unit 28 over 
a one-way outgoing line 40 to counter 30, while the time 
code is exchanged between counter 30 and control unit 28 
over line 38, as explained in more detail later on. 

Power supply unit 32, which supplies the various 
components of receiver 3 over line 43 and is in turn 
supplied at input 44 by the vehicle battery (not shown), 
is connected to a rechargeable buffer battery 45 capable 
of powering the receiver and updating the counter over a 
period of months, even in the event of the vehicle 
battery being disconnected or running down. 

The transmitter and receiver are first 
synchronized alongside customization of the receiver, 
which is effected in known manner (as described, for 
example, in the above patents filed by Turatti Mario) , 
and provides for entering the same identification code 
and the same start value of the counter (time code) in 
both parts of the control. In actual use, counters 7 and 
30 of transmitter 2 and receiver 3 evolve in the same 
way, incrementing by one unit at predetermined time 
intervals (e.g. every 10 seconds) on the basis of the 
pulses generated by respective control units 4 and 28. 
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Any inaccuracy of clocks 8 and 31 (detected when testing 
the control) may be compensated by control units 4 and 
28 via software/ in the same way as for digital clocks, 
for achieving a high degree of precision in the timing 
of the increment pulses. 

Despite varying with time, the content of counter 
7 is therefore equal at all times to that of counter 30 , 
and may thus be employed for enabling receiver 3 to 
recognize the associated transmitter. More specif ically, 
whenever it is turned on, the transmitter supplies the 
recognition code valid at that particular time and 
consisting of both the fixed identification code (in 
memory 6) and the time code (counter 7) varying 
according to when the transmitter is turned on. 

Fig.s 2 and 3 show two examples of the code 
transmitted. In the Fig. 2 example, the code consists of 
two sequentially transmitted parts r fixed identification 
code portion A, and time code portion B. In this 
particular case, the identification code comprises 24 
binary digits (A1-A24) followed by four binary time code 
digits (B1-B4), the advantage of which solution is that 
it can also be applied to conventional type receivers 
using only the first fixed portion digits and ignoring 
the rest. In the Fig. 3 example, on the other hand, the 
time code digits (B1-B4) are mixed with the fixed 
identification code digits (A1-A24) for achieving 
greater code protection. The time code digits may be 
located differently from one code to another, thus 
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providing for a sort of cryptosystem, in which case^ the 
recognition code may also comprise further decryption 
key digits. 

Under correct operating conditions/ the incoming 
code to receiver 3 matches the reference code, so that 
an enabling signal is supplied to output 35 for enabling 
the actuator. Conversely , if the incoming code fails to 
match the reference code, even if only as regards the 
time code, the transmitter is considered invalid, and 
the enabling signal is not supplied. In other words, 
even if the recognition code is memorized correctly at a 
given time using an automatic code copier, it is 
subsequently rendered ineffective by failing to evolve 
in the manner identified by the receiver. 

Recognition of the time code by receiver 3 
preferably allows of a small amount of error by 
acknowledging time codes within a predetermined range in 
relation to the nominal value. Moreover, in the event of 
the time code being acknowledged, the receiver writes 
the incoming time code over that supplied by counter 30, 
so as to reset the timing error each time 
(resynchronization) . In any case, provision is made for 
manually resynchronizing the receiver in the event of a 
loss of synchronism in relation to the transmitter, e.g. 
due to prolonged disconnection or discharge of the 
vehicle battery over and above the supply capacity of 
buffer battery 45, or prolonged disconnection or 
discharge of the transmitter battery. Obviously, manual 
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resynchronization of the receiver involves a special 
procedure for maintaining security of the remote 
control . 

Operation relative to transmission and recognition 
of the code and resynchronization of the receiver will 
now be described in detail with reference to Fig.s 4 and 
5. 

The Fig. 4 flow chart shows the operating sequence 
as of when the transmitter is turned on by the user 
pressing key 18 (block 50). When the transmitter is 
turned on^ control unit 4 reads the identification code 
(CODICETX) stored in memoir 6^ and the current content 
of counter 7 (RTCTX) (block 51), and generates the 
actual recognition code according to the required code 
structure, possibly also encrypting the code or the 
fixed portion of it and adding a number of decrypting 
key digits. The recognition code is then supplied to 
amplifier 9 and transducer 10 by which it is modulated 
in Jcnown manner and transmitted in the form of infrared 
pulses (block 52). 

The transmitted recognition code is received by 
receiving transducer 26 and, after being amplified, is 
supplied to control unit 28 of receiver 3 (block 53), 
which in turn reads the reference identification code 
stored in memory 29 (CODICERX), and the current content 
of counter 30 (RTCRX) (block 54); if necessary, decrypts 
the incoming identification code CODICETX (block 55); 
and compares the two identification codes CODICETX and 
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CODICERX (block 56) • If the two codes fail to match (NO 
output of block 56), the actuator remains disabled, and 
control unit 28 supplies LED 34,. which flashes briefly 
to indicate an error in the identification code (block 

57) , which thus marks the end of the procedure. 

Conversely, if the two identification codes are 
found to match (YES output of block 56), control unit 28 
compares the incoming time code RTCTX with the reference 
time code RTCRX plus or minus a given error A (block 

58) , and, if the incoming time code falls within the 
tolerance range of the receiver (YES output of block 
58), enables the actuator (block 59) and rememorizes the 
incoming time code RTCTX in counter 30, which is 
resynchronized to said value (block 60), thus marking 
the end of the procedure. 

In the event of the two time codes failing to 
match within the given tolerance range (NO output of 
block 58), control unit 28 provides for supplying LED 
34, which flashes to show acknowledgement of the 
identification code, but an error in the time code 
(block 61). The procedure therefore terminates without 
enabling the actuator, thus preventing unlawful entry by 
transmitting a recognition code copied and therefore set 
to a previous instant in time. Should the time code fail 
to be acknowledged due to a loss of synchronism between 
the transmitter and receiver, this must be 
resynchronized manually as shown in detail in Fig. 5. 
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The first stage in the resynchronizing procedure 
consists in manually opening the receiver (block 70) in 
the same way as for entering fixed identification codes 
on user- variable-code transmitters (as described, for 
example, in the aforementioned patents filed by Turatti 
Mario) . To open the receiver, the user, by means of key 
33, enters the code supplied with the remote control 
(e.g. the encrypted identification code printed on the 
transmitter label), and then turns on the remote 
control, at which point, control unit 4 (block 71) reads 
the identification code CODICETX and time code RTCTX, as 
described in connection with block 51 in Fig. 4. Both 
codes are composed as already described, and transmitted 
via pulses (block 72). Receiver 3 receives the incoming 
pulses (block 73) and stores the incoming identification 
code CODICETX and time code RTCTX (decrypted if 
necessary) in memory 29 and counter 30 respectively 
(block 74), thus resynchronizing the transmitter and 
receiver (the identification code is rememorized by 
virtue of the procedure also providing for modifying the 
identification code in known manner) . 

The advantages of the remote control and the 
remote control method according to the present invention 
will be clear from the foregoing description. By virtue 
of transmitting both a transmitter identification code 
and a transmission time code, the present invention 
provides for safeguarding the receiver against 
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unauthorized control, and so achieving a high degree of 

security of the remote control as a whole. * 

Security is even further enhanced by encrypting 
the recognition code, either traditionally by encrypting 
the fixed identification code or time code, or by mixing 
the fixed and time code digits, or by varying the manner 
in which the time code evolves, thus making unlawful 
entry highly unlikely, even in the event of attempts to 
update the copied time code. 

Automatic resynchronization of the receiver and 
transmitter each time the recognition code is matched 
(in addition to software correction of the clock 
frequency) provides for counteracting possible drift of 
either one of the clocks, " while the manual 
resynchronizing procedure enables the system to be 
re-initialized by the user, for further confounding 
unauthorized users. 

Yet a further advantage is the provision of 
short-term supply systems for supplying the transmitter 
and receiver in the event of disconnection or discharge 
of the respective batteries, so that the remote control 
need not be resynchronized each time the transmitter 
battery is changed or the vehicle battery runs down. 

To those skilled in the art it will be clear that 
changes may be made to the remote control and method 
described and illustrated herein without, however, 
departing from the scope of the present invention. For 
example, the time code may evolve in any manner 
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providing it is correlated on both the transmitter and 
receiver? the overall recognition code may be encrypted 
in various ways as already suggested; and the receiver 
may comprise a number of storage locations and counters 
(or one storage location with different transformations 
or various encryptions for producing various fixed 
identification codes, and/or one counter with different 
transformations for producing various time codes) for 
recognizing a niunber of transmitters associated with the 
same receiver, in which case, each memory and each 
counter are independent and can be modified separately. 



CLAIMS 



1) An extra-safe remote control (1), particularly 
for controlling a vehicle-mounted actuating element, 
said control (1) comprising a transmitter (2) having 
transmission transducer means (10) for transmitting a 
recognition code; and a receiver (3) having receiving 
transducer means (26) for receiving said recognition 
code, and means (28, 58) for generating an enabling 
output signal (35) in the event of the incoming 
recognition code substantially matching a reference 
code; characterized by the fact that said transmitter 
(2) and said receiver (3) comprise respective means (7, 
30) for generating a time code varying with time. 

2) A remote control as claimed in Claim 1, 
characterized by the fact that said generating means 
respectively comprise at least one transmission and 
receiving counter (7, 30) having an input (15, 40) for 
receiving increment pulses ^ and an output (14, 38) for 
supplying a variable number correlated to said increment 
pulses • 

3) A remote control as claimed in Claim 2, 
characterized by the fact that said transmitter (2) and 
said receiver (3) respectively comprise at least one 
transmission and receiving memory (6, 29) for storing a 
fixed identification code. 

4) A remote control as claimed in Claim 3, 
characterized by the fact that said transmitter (2) 
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comprises a transmission control unit (4) connected to 
said transmission counter (7), to said transmission 
memory (6), and to an operating key (18); said 
transmission control unit (4) comprising means (50) for 
detecting operation of said key (18); means (51) for 
reading said identification code in said transmission 
memory (6) and said time code in said transmission 
counter (7); and means (52) for generating a 
predetermined transmission sequence from said 
identification and time codes. 

5) A remote control as claimed in Claim 4^ 
characterized by the fact that said transmission 
transducer means (10) comprise means for sequentially 
transmitting infrared pulses. 

6) A remote control as claimed in Claim 4 or 5, 
characterized by the fact that said receiver (3) 
comprises a receiving control unit (28) connected to 
said receiving counter (30)/ to said receiving memory 

(29) , and to said receiving transducer means (26); said 
receiving control imit (28) comprising means (56, 58) 
for comparing the incoming identification code with the 
content of said receiving memory (29), and the incoming 
time code with the content of said receiving counter 

(30) , and for generating said enabling signal in the 
event of both matching. 

7) A remote control as claimed in Claim 6, 
characterized by the fact that said receiving control 
unit (28) comprises means (60) for writing said incoming 



time code in said receiving counter (30) subsequent to 
generation of said enabling signal, 

8) A remote control as claimed in Claim 6 or 7/ 
characterized by the fact that said receiver (3) 
comprises a key (33) for updating said recognition code. 

9) A remote control as claimed in one of the 
foregoing Claims from 3 to 8, characterized by the fact 
that said memories (6, 29) are EEPROMs. 

10) A remote control as claimed in one of the 
foregoing Claims from 1 to 9, characterized by the fact 
that said transmitter (2) comprises a supply stage (5) 
having a supply output (11) connected to a capacitor 
(12). 

11) A remote control as claimed in one of the 
foregoing Claims from 1 to 10^ characterized by the fact 
that said receiver (3) comprises a supply stage (32) 
supplied externally via a main supply input (44) and 
having an auxiliary supply input connected to a buffer 
battery (45). 

12) A remote control as claimed in one of the 
foregoing Claims from 6 to 11, characterized by the fact 
that said receiving control unit (28) is connected to a 
light-emitting element (34) for indicating 
acknowledgement of said identification code only. 

13) A method for remote control of an actuating 
element, said method comprising stages consisting in: 
transmitting (51, 52) a recognition code, receiving (53) 
said recognition code, comparing (54, 56, 58) the 
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incoming recognition code with a reference code, and 
generating (59) an enabling signal in the event of said 
incoming recognition code substantially matching said 
reference code; characterized by the fact that said 
recognition code transmitting stage comprises stages 
consisting in: generating (51) a time code varying with 
time, and transmitting (52) said time code; and said 
stage wherein said incoming recognition code is compared 
with said reference code comprises stages consisting in: 
generating (54) a reference time code varying with time, 
and comparing (58) said incoming time code with said 
reference time code. 

14) A method as claimed in Claim 13, characterized 
by the fact that said stages consisting in generating 
(51) a time code and generating (54) a reference time 
code comprise stages consisting in memorizing and 
periodically incrementing an initial value. 

15) A method as claimed in Claim 14, characterized 
by the fact that said enabling signal is generated in 
the event of said incoming time code matching said 
reference time code within a given error range, 

16) A method as claimed in one of the foregoing 
Claims from 13 to 15, characterized by the fact that 
said stage consisting in transmitting said recognition 
code also comprises a further stage consisting in 
reading (51) a fixed identification code, and 
transmitting (52) said identification code together with 
said time code; and by the fact that said stage 
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consisting in comparing said incoming recognition code 
with said reference code also comprises a further stage 
consisting in reading (54) a fixed reference 
identification code, and comparing (56) said reference 
identification code with said incoming identification 
code. 

17) A method as claimed in Claim 16, characterized 
by the fact that it comprises stages consisting in: 
detecting (50) operation of an operating key (18); 
reading (51) said identification code and said time 
code; and generating (52) a predetermined transmission 
sequence from said identification and time codes. 

18) A method as claimed in Claim 17, characterized 
by the fact that said identification code and said time 
code are transmitted consecutively. 

19) A method as claimed in Claim 17, characterized 
by the fact that the digits of said identification code 
and said time code are transmitted mixed in a 
predetermined manner, 

20) A method as claimed in one of the foregoing 
Claims from 17 to 19, characterized by the fact that 
said identification code is encrypted prior to 
transmission, and decrypted (55) prior to being compared 
with said reference identification code. 

21) A method as claimed in one of the foregoing 
Claims from 13 to 17, characterized by the fact that 
said recognition code is transmitted via infrared 
pulses. 
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22) A method as claimed in one of the foregoing 
Claims from 16 to 21, characterized by the fact that, 
subsequent to generation (59) of said enabling signal, 
the incoming time code is written (60) over said 
reference time code. 

23) A method as claimed in one of the foregoing 
Claims from 16 to 22, characterized by the fact that a 
predetermined light signal is generated (57) upon 
detection (56) of matching identification codes but 
mismatching time codes. 

24) A recognition code transmitted between the 
transmitter and receiver of a remote control, in 
particular, for controlling an actuating element, 
characterized by the fact that it comprises a time code 
(B) varying with time, for coding the instant in which 
transmission is effected. 

25) A code as claimed in Claim 24, characterized 
by the fact that it also comprises a fixed portion 
defining an identification code (A) not varying with 
time. 

26) A code as claimed in Claim 24 or 25, 
characterized by the fact that it is transmitted in the 
form of a sequence of infrared pulses. 

27) An extra-safe remote control, method for 
remote control of an actuating element, and recognition 
code, substantially as described and illustrated herein 
with reference to the accompanying drawings. 
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